2

enter image description here

tell me please why continues to execute the command ping...

Router#ping vrf vrf-trust 50.50.50.50 sou 2.2.2.2

Type escape sequence to abort.
ending 5, 100-byte ICMP Echos to 50.50.50.50, timeout is 2 seconds:
Packet sent with a source address of 2.2.2.2 
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/4 ms

while there is no specify route back to 2.2.2.2 in Routing table .

UntrustGi-vr.inet.0: 9 destinations, 9 routes (9 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

10.10.10.0/24      *[Static/5] 21:31:56
                > to 14.0.64.1 via ge-0/0/1.0
14.0.64.0/24       *[Direct/0] 1d 09:03:47
                > via ge-0/0/1.0
14.0.64.2/32       *[Local/0] 1d 09:40:15
                  Local via ge-0/0/1.0
20.20.20.0/24      *[Static/5] 21:31:56
                > to 14.0.64.1 via ge-0/0/1.0
30.30.30.0/24      *[Static/5] 21:31:56
                > to 14.0.64.1 via ge-0/0/1.0
40.40.40.0/24      *[OSPF/10] 1d 09:00:35, metric 2
                > to 14.0.64.1 via ge-0/0/1.0
50.50.50.0/24      *[OSPF/10] 21:37:17, metric 2
                > to 14.0.64.1 via ge-0/0/1.0
60.60.60.0/24      *[OSPF/10] 1d 09:00:35, metric 2
                > to 14.0.64.1 via ge-0/0/1.0
224.0.0.5/32       *[OSPF/10] 2d 00:06:40, metric 1
                  MultiRecv

but recently, this route was. But now I deleted it.

Maybe it's because SRX remembered session. but I entered command clear security flow session all but ping continues...

[edit routing-instances UntrustGi-vr]
admin# run show route 

inet.0: 2 destinations, 2 routes (1 active, 0 holddown, 1 hidden)
+ = Active Route, - = Last Active, * = Both

224.0.0.5/32       *[OSPF/10] 3d 00:31:23, metric 1
                      MultiRecv

Trust-vr.inet.0: 10 destinations, 10 routes (10 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

0.0.0.0/0          *[Static/5] 1d 04:08:21
                      to table UntrustGi-vr.inet.0
1.1.1.0/24         *[Static/5] 1d 12:31:58
                    > to 7.7.7.1 via ge-0/0/0.0
2.2.2.0/24         *[Static/5] 1d 12:30:19
                    > to 7.7.7.1 via ge-0/0/0.0
3.3.3.0/24         *[Static/5] 1d 12:30:19
                    > to 7.7.7.1 via ge-0/0/0.0
4.4.4.0/24         *[OSPF/10] 1d 12:50:53, metric 2
                    > to 7.7.7.1 via ge-0/0/0.0
5.5.5.0/24         *[OSPF/10] 1d 12:45:48, metric 2
                    > to 7.7.7.1 via ge-0/0/0.0
6.6.6.0/24         *[OSPF/10] 1d 12:50:53, metric 2
                    > to 7.7.7.1 via ge-0/0/0.0
7.7.7.0/24         *[Direct/0] 1d 12:54:13
                    > via ge-0/0/0.0
7.7.7.2/32         *[Local/0] 1d 13:30:28
                      Local via ge-0/0/0.0
224.0.0.5/32       *[OSPF/10] 2d 04:41:34, metric 1
                      MultiRecv

UntrustGi-vr.inet.0: 9 destinations, 9 routes (9 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

10.10.10.0/24      *[Static/5] 1d 01:22:09
                    > to 14.0.64.1 via ge-0/0/1.0
14.0.64.0/24       *[Direct/0] 1d 12:54:00
                    > via ge-0/0/1.0
14.0.64.2/32       *[Local/0] 1d 13:30:28
                      Local via ge-0/0/1.0
20.20.20.0/24      *[Static/5] 1d 01:22:09
                    > to 14.0.64.1 via ge-0/0/1.0
30.30.30.0/24      *[Static/5] 1d 01:22:09
                    > to 14.0.64.1 via ge-0/0/1.0
40.40.40.0/24      *[OSPF/10] 1d 12:50:48, metric 2
                    > to 14.0.64.1 via ge-0/0/1.0
50.50.50.0/24      *[OSPF/10] 1d 01:27:30, metric 2
                    > to 14.0.64.1 via ge-0/0/1.0
60.60.60.0/24      *[OSPF/10] 1d 12:50:48, metric 2
                    > to 14.0.64.1 via ge-0/0/1.0
224.0.0.5/32       *[OSPF/10] 2d 03:56:53, metric 1
                      MultiRecv
Improve this question
8
  • What does the routing table look like on 50.50.50.50?
    – Ryan Foley
    Mar 7, 2014 at 9:12
  • Fizzle, believe that routing all right!My question that packets should not go back because there is no route to the network 2.2.2.0/24. recently, this route was. But now I deleted it.But reply on ping is still continues. perhaps this is due to the ability to store session by juniper srx. how to reset the session. "clear security flow session all" does not help .
    – Vitaliy
    Mar 7, 2014 at 10:02
  • I understand your routing may be correct, but routing happens both ways, which means it's important to see what the routing table on 50.50.50.50 looks like and where it's sending packets to. Is there a default route that points back to 14.0.64.2?
    – Ryan Foley
    Mar 7, 2014 at 10:09
  • I understood you. I certify that the reverse traffic must necessarily go through the interface ge-0/0/1 (14.0.64.2) which is in Routing-instance UntrustGi-vr.
    – Vitaliy
    Mar 7, 2014 at 10:18
  • Router#show ip route vrf vrf-untrustgi S* 0.0.0.0/0 [1/0] via 14.0.64.2
    – Vitaliy
    Mar 7, 2014 at 10:21

1 Answer 1

Reset to default
3

Based on your comments, everything looks correct. Althought 50.50.50.50 may not have a direct/learned route to 2.2.2.2, he does have a default-gateway set to 14.0.64.2. 

Router#show ip route vrf vrf-untrustgi 
  S* 0.0.0.0/0 [1/0] via 14.0.64.2

If you didn't have an interface locally that was available to respond to ping, you wouldn't be able to use it. The functionality might exist in a an ASA to use a random addresses, presumably for security auditing reasons. It would look similar to this:

Router#ping 8.8.8.8 source 2.2.2.2
% Invalid source address- IP address not on any of our up interfaces
Router#
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.